drummergirl

FYI for anyone else experiencing this issue… I ran a ticket through hostgator and this is the response:

“I ran a script against your domain and it did detect pages being blocked by mod_security. I went ahead and whitelisted the rule and would be interested to know if it affected the issue. Can you please try to replicate the hanging issue for me? If it is still happening we will try other things and further diagnostics.”

So far it seems to have worked.

This may or may not be a piece of the puzzle, but I am experiencing these same lag issues, specifically on Hostgator sites. I’ve put in a ticket but not gotten anywhere with their suggested solutions.

One day I happened to be debugging an issue in Safari and the usual hang ups were non-existent. I went back to chrome (my usual browser) and boom – the site started hanging again. Went back to Safari and it was fine. I’ve been going back and forth with both browsers now for about a month and Safar never hangs on me. Only Chrome.

Tried the “.mp3” fix but it’s still not working in IE for me. I get the message:

Message: Object doesn’t support this property or method
Line: 22
Char: 162
Code: 0
URI: https://fourwallflight.com/music/you-pursue-me/

Any other ideas? Would really like to keep this plugin but it’s dead in the water right now for us.

I agree it’s a bandaid – I’m just concerned about not resolving this before I have to leave on a trip next week.

If the bandaid would get me through a few days of no internet access, it may be my only option until I return. Still waiting on the VPS techs to report back to me.

Can I chmod that file to keep it from getting changed or will that prevent wordpress from working properly?

Just happened again:

this is what is inserted into the index.php file:

eval(base64_decode(‘…yada yada yada….’));

How do I track down where it is coming from? All passwords have been changed. I’ve scanned my wp-content folder both online and off. Ideas?

I may have to pay them to manage it. I got kicked off shared hosting because my site grew too big. I’m not on a VPS because I want to be there. :/

@brightim – I removed bad behavior completely last night, but I was hacked again this morning.

@smrdo – I ran that already. Didn’t find anything. :/

I have narrowed it down to the index.php as the only file being affected whenever it happens. I just need to figure out what is triggering it.

At the moment I submitted a ticket to my VPS company to run a full scan on my server.

Day #3 and it’s still showing up…

Mac scanned – no issues other than my site’s pages getting flagged in chrome cache

Windows VM scanned – no issues

All site files downloaded and scanned – nothing found

FTP password changed, admin password changed.

Any other ideas?

Ok MacKeeper anti-virus just alerted me to a chrome cache file:

infected.webpage.gen

That’s just a cache file from my site, right? That wouldn’t be the root cause, correct?

I’m on a Mac and it came up clean. The site is on my VPS and none of my other sites on the same VPS are not affected. Is there anything else I should check?

Still happening every hour. Plugins are updated as is WP. All unused plugins have been deleted. Ftp passwords changed.

Anywhere else I should look? I’m currently scanning my files to see where it’s being inserted.

Solved it. Just had to move my rewrite rule ABOVE the wordpress rules.

Still drawing a blank on this. Anyone have any idea if I should have the old subdomain listed in cpanel or not?

I was thinking it could all be handled in the htaccess file, but I seem to get closer results with the subdomain present in cpanel and redirecting to the main domain (although it sends them to my 404 page, at least it gets them to the domain as opposed to a 500 error or something).

For what it’s worth, I got this working… not sure what I screwed up the first time, but here is the code that works:

[Code moderated as per the Forum Rules. Please use the pastebin]